CVE-2026-82681: CWE-116 Improper Encoding or Escaping of Output in ash-project ash_admin

The vulnerability in ash_admin arises from raw string interpolation of primary keys and other parameters into row-action URLs without proper URL-encoding. Since ash_admin often uses user-controlled string primary keys (such as slugs or emails), an attacker can craft a primary key containing characters like '&' or '#' to inject or truncate query parameters. This allows overriding the intended action of links, for example, redirecting an admin from an edit action to a destroy action or arbitrary resource. The issue affects versions starting at 0.3.0-rc.0 up to but not including 1.3.1. The fix involves encoding all interpolated values using URI.encode_query/1 to prevent parameter injection.

An attacker who can control a record's string primary key can manipulate the URLs of row-action links in ash_admin, potentially causing an admin user to perform unintended actions such as destroying a resource instead of editing it. This could lead to accidental or malicious modification or deletion of resources through the admin interface. However, the CVSS score is low (2.0), indicating limited impact and requiring user interaction with low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves encoding all interpolated URL parameters with URI.encode_query/1 to prevent injection. Until an official fix is confirmed, avoid using untrusted string primary keys in URLs or apply manual URL encoding of parameters in custom implementations.